Configuration of Kerberos SSO in TrueConf Server

TrueConf Server supports password-free authentication with the help of single sign-on technology and the Kerberos protocol. This feature will be available if the integration with a directory service is configured via LDAP. Read this article to take a look at some examples.

The overall guideline for setting up Kerberos SSO includes the following steps:

1. Add SPN (more details below).
2. Generate a keytab file.
3. Apply settings on the server side.

In the context of Kerberos SSO, it is important to understand the meaning of Service Principal Name (SPN). What is it? SPN is the unique identifier of a service instance. In our case TrueConf Server acts as such a service for the domain controller. SPN consists of several parts:

The public server name specified during registration should be used as service.name.

Example:

The examples described in this article will be based on the use of the command line. However, you can also use GUI.

Active Directory

In Active Directory (AD) the service principal name (SPN) is linked either to the computer account or user account. We urge you not to link the SPN to the machine where TrueConf Server is deployed because it may have an adverse effect on its work in the domain. To ensure correct work, you will need to create a separate account with certain parameters:

• Password change is prohibited
• Password lifetime is not restricted.

This precaution is very important because otherwise it will be necessary to generate new keytab files linked to the user if the password is either changed or expires.

To configure Kerberos SSO, take these steps:

1. Run PowerShell as the administrator and import the module for working with the AD service:
   
   PowerShell

   Import-Module ActiveDirectory

   1	Import-Module ActiveDirectory

2. Assign required values to the following variables:
   
   PowerShell

   $Username = "kb_user" # Username $Password = "UserPassword!"# User password $DisplayName = "KB_USER" # User display name $Path = "OU=Users,DC=yourdomain,DC=loc" # Path to the organizational unit where the user will be created.

   1 2 3 4

   $Username = "kb_user" # Username $Password = "UserPassword!"# User password $DisplayName = "KB_USER" # User display name $Path = "OU=Users,DC=yourdomain,DC=loc" # Path to the organizational unit where the user will be created.

3. Run this command to create a new service user based on the specified variables:
   
   PowerShell

   New-ADUser -Name $DisplayName -SamAccountName $Username -Path $Path -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -PasswordNeverExpires $true -CannotChangePassword $true

   1	New-ADUser -Name $DisplayName -SamAccountName $Username -Path $Path -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -PasswordNeverExpires $true -CannotChangePassword $true

4. Add an SPN and link it to the created user:
   
   PowerShell

   setspn -U -S trueconf/server.name@yourdomain.loc $Username

   1	setspn -U -S trueconf/server.name@yourdomain.loc $Username

5. Generate a keytab file:
   
   PowerShell

   ktpass -princ trueconf/server.name@YOURDOMAIN.LOC -mapuser $Username -crypto ALL -ptype KRB5_NT_PRINCIPAL -pass $Password -target yourdomain.loc -out С:\yourdomain.keytab

   1	ktpass -princ trueconf/server.name@YOURDOMAIN.LOC -mapuser $Username -crypto ALL -ptype KRB5_NT_PRINCIPAL -pass $Password -target yourdomain.loc -out С:\yourdomain.keytab

Then, go to the TrueConf control panel and configure Kerberos SSO as it is described in the documentation.

FreeIPA

In FreeIPA SPN is linked to the current server instance, in other words, to the existing A record of the DNS server. So, if the TrueConf Server instance has not been added, it is the right time to do it. To configure SSO via Kerberos:

1. Open the terminal and get a ticket (kerberos-ticket) with this command:
   
   ZSH

   kinit admin # username of the domain administrator

   1	kinit admin # username of the domain administrator

2. Assign required values to the following variables (without spaces):
   
   ZSH

   IP_ADDRESS=10.10.10.10 # service IP address (TrueConf Server instance) TRUECONF=video.example.net # Full domain name of the server FREEIPA=freeipa.example.lan # Full domain name of the domain controller

   1 2 3

   IP_ADDRESS=10.10.10.10 # service IP address (TrueConf Server instance) TRUECONF=video.example.net # Full domain name of the server FREEIPA=freeipa.example.lan # Full domain name of the domain controller

3. Add the TrueConf Server instance with the specified variables by running the command:
   
   ZSH

   sudo ipa host-add --force --ip-address=$IP_ADDRESS $TRUECONF

   1	sudo ipa host-add --force --ip-address=$IP_ADDRESS $TRUECONF

4. Add the SPN service:
   
   ZSH

   sudo ipa service-add trueconf/$TRUECONF

   1	sudo ipa service-add trueconf/$TRUECONF

5. To generate a keytab file, run the command:
   
   ZSH

   sudo ipa-getkeytab -s $FREEIPA -p trueconf/$TRUECONF -k trueconf.keytab

   1	sudo ipa-getkeytab -s $FREEIPA -p trueconf/$TRUECONF -k trueconf.keytab

Then go to the TrueConf Server control panel and configure Kerberos SSO as it is described in the documentation.